1

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just an internal server, I put the CN=10.3.3.3. All of our desktop machines work just fine (they give a warning about the certificate, but after we tell the browser to connect anyways, it works just fine). This is true of all browsers I've tried on the desktop machines (chrome, firefox, safari).

The problem is on my android phone and chromebook. On both of these, when I type in the ip address, I get the typical chrome yellow screen saying there is something wrong with the certificate. When I click "proceed anyways", it looks like it is trying to load, but the site never comes up. What do I need to do to get chrome on these mobile devices to work?

P.S. I did import the certificate into Chrome on the chromebook and it shows up under "Authorities".

As an interesting test, I downloaded a ChromiumOS virtual machine and it works just fine (gives cert error, but when I click proceed, everything works fine). I should have noted that the chromebook and the android phone are coming in over VPN, but everything else on the VPN works fine (ssh to the web server, etc).

The Certificate 


Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9485437517293169565 (0x83a30b2a7d6c2b9d)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=XX, ST=XX, L=XXXX, O=XXXXXX
        Validity
            Not Before: Apr  2 12:41:40 2014 GMT
            Not After : Apr  1 12:41:40 2016 GMT
        Subject: C=XX, ST=XX, L=XXXX, O=XXXXXX
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    XXXXXXXXXX
                Exponent: XXXXX
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Certificate Sign
            X509v3 Subject Alternative Name: 
                IP Address:10.3.3.3
    Signature Algorithm: sha1WithRSAEncryption
Improve this question

2 Answers 2

Reset to default
2
+50
  • the common name cannot be an IP address. You may put IP addresses into the subject alternative name section, but as IP address not DNS
  • the certificate might need a CA=true property if you want to import it as authority, simply self-signing might not be enough. You might still be able to import it and it will show up, but does not work.
  • it failed for me for Firefox and Chrome until I've put also extended key usage of "TLS Web Server Authentication" in the certificate and also Netscape Cert Type 'server', which seems to be missing from your certificate. After I've added both it also works with Chrome on Android.

This is the certificate which works for me:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1893982163 (0x70e3dfd3)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=foo.com
        Validity
            Not Before: Apr  7 18:47:17 2014 GMT
            Not After : Apr  7 18:47:17 2015 GMT
        Subject: CN=foo.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus: ...
                 Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                32:04:C3:BF:60:46:D4:4A:90:2F:CC:55:F1:B1:7D:B7:BF:7A:61:4B
            X509v3 Authority Key Identifier:                    keyid:32:04:C3:BF:60:46:D4:4A:90:2F:CC:55:F1:B1:7D:B7:BF:7A:61:4B

            X509v3 Authority Key Identifier: 
                DirName:
                serial:70:E3:DF:D3

            X509v3 Subject Alternative Name: 
                IP Address:192.168.178.4
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            Netscape Cert Type: 
                SSL Server
    Signature Algorithm: sha256WithRSAEncryption
        ....
Improve this answer
15
  • After I posted this I tried putting the IP in the subject alternative name (have had CA=true the whole time) and it still didn't work.
    – mikeazo
    Apr 2, 2014 at 11:37
  • 1
    It's hard to tell more without seeing the certificate.
    – Steffen Ullrich
    Apr 2, 2014 at 20:10
  • I added details on the cert. Thanks for your help.
    – mikeazo
    Apr 7, 2014 at 12:44
  • Looks to me that it is not a certificate issue. Can you check by accessing the website on android and chromebook after disabling SSL on the server or using a plain HTTP link? That will tell us if its due to the certificate or not.
    – xkcd
    Apr 7, 2014 at 17:07
  • @mikeazo: see edited response. You probably need to add extended key usage of "TLS Web Server Authentication".
    – Steffen Ullrich
    Apr 7, 2014 at 18:31
0

Turns out the problem had nothing to do with the certificate and everything to do with the fact that the client was coming in over the VPN. When the client was physically on the network, everything worked fine.

I ended up having to change the MTU on the ubuntu server and everything worked fine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .